GRC CUP 5.3 SP16.3 Mitigation Controls automation removal

[Former Member]

Does anyone know that if you create any user requests to remove roles from a user, that if any mitigation controls were assigned to the users for those roles, the mitigating control ids can also be automatically removed from RAR during auto provisioning of the request?

Right now, GRC CUP, if configured properly, during auto provisioning, will assign the mitigation controls automatically to the userid in RAR to mitigate the risks when the request is processed if the new access will give any SOD violations. But if you remove the roles from a user and he/she had any mitigation ids assigned in RAR, can the request also automatically remove the mitigated control id associated with it if the user will no longer have that risk? I have not seen the request automatically remove the mitigated id from RAR when the role was removed from the user id during auto provisioning. But I'm not sure if this requires additional workflow configuration or not.

Will greatly appreciate if any1 is aware of this issue and how to resolve it. Or is the only solution to manually remove it from RAR..but this can be tiresome..bc then you have to run the report every week or month in RAR to remove the excessive controls assigned if the users do not have the risks anymore..comparing reports from current to previous month, etc.

Thanks,

A.

[Former Member · Accepted solution]

Hi Alley,

It is not possible to automate the removal of mitigation controls through a workflow in CUP. The only solution is to review on a regular basis and remove them manually from RAR

We also has the same issue and performing manual review at regular intervals of the user & role assigned mitigation controls

Best Regards,

Srihari.K

[Former Member · Accepted solution]

Hi

We had the same issue earlier, we are maintaining excel sheets

We are in periodic reviews and started removing the owner/users if anybody resigned from the client

[Former Member · Accepted solution]

Thanks guys,

That's what I figured!

A.